Quantcast
Channel: VMware Communities : All Content - All Communities
Viewing all 180923 articles
Browse latest View live

Lookup Service Url in vCenter 6.7 or 6.5

$
0
0

Hi,

 

Am trying to find the lookupservice url for a vCenter ESXi version 6.5 .

Tried searching so far , not any luck. Can someone help me with the url ?

Appreciate any pointers

 

Thanks,

Arvind


Management vmk dropping packets when vmnics are teamed

$
0
0

Looking for help with the following issue:

 

Issue: When I team two or more physical nics on my ESXi 5.5 U1 host on the vswitch containing the management vmk and ping the host management vmk IP address from other devices it will drop packets.

 

Here is some information that I believe may be helpful to others in diagnosing my issue:

 

- The packet drop rate seems to be between 5-10% when pinging the mgmt vmk from another device on the network.

- When I ping from the ESXi host out to other network devices I get NO packet loss in my outbound pings.

- As soon as I remove the teamed NIC from the vSwitch and go back to using just one physical NIC the problem disappears.

- I am using "Route based on the originating virtual port ID" for my load balancing algorithm on the vSwitch and vmk port itself. No specific configuration settings have been done at the switch level in relationship to this.

- All the host's physical NICs are connected to a stack of 6 Dell PowerConnect M8024k switches. All 6 physical switches are cabled together and configured as one logical switch stack. M8024k switches are all I/O modules in the back of blade chassis.

- All physical NICs are dual-port Broadcom 57810 CNAs. There are total of 6 ports for each host spread across 3 CNAs.

- Al physical NICs are running NPAR to split each physical NIC port out into 4 virtual NICs. This results in a total of 24 vmnics for the host. (6 ports * 4 NPAR functions per port = 24)

- All NIC ports have a native untagged VLAN that the mgmt vmk uses and also carry additional tagged VLANs. Connecting ports on the M8024k switches run in General (hybrid) mode with the mgmt vmk vlan as the untagged vlan.

- Server hardware is Dell PowerEdge M620 Blade server.

 

Any help would be greatly appreciated. Have seen this issue on multiple hosts running off this particular blade chassis. On other hosts the problem seemed to magically disappear at some point but I cant seem to pin down what configuration change I made on them that resolved the issue for the other hosts.

 

Thanks,

Mike

Provisioning Machine not displaying "provisioning mode" pop-up

$
0
0

Hello All,

 

Firstly, thank you for your time and attention.

 

Premise: We are running Horizon 7 looking to implement App Volumes. I successfully installed the App Volumes Manager on a Windows Server 2016 VM. For the App Volumes Agent, I installed it on a "master" VDI image that we use for recomposing purposes within our VDI environment (I did take a snapshot which I revert to after the agent install until we're ready to fully deploy the Agent to our VDI production pool). I set up a "Test" desktop pool in Horizon as well as a "Test" Appstack which I created just for testing purposes. To create the provisioning (capture) machine, I cloned the VDI master image with the App Volumes Agent. Note*: Because of the cloning process, the new provisioning VM and the VDI master image share the same hostname (IP address is different due to DHCP).

 

Problem: When selecting the provisioning machine, during the provisioning process, I choose the newly created VM (cloned from VDI master). The IP address and VM duration time are verified (within the Directory > Online tab) to point to the provisioning VM and not to the VDI master (which is currently turned off). From the App Volumes > Appstacks tab, it shows that I am in provisioning mode. However, on the provisioning VM, the "you are now in provisioning mode" pop-up does not appear, even if I restart the VM. When I shut off the provisioning VM and turn on the VDI master image, the pop-up does appear when I log in. I don't want to use the master VDI image as a provisioning machine. 

 

Could it be because the provisioning machine is not the original holder of the hostname? Any help or insight as to why I'm experiencing this would be amazing. Thank you again for your time.

Upgrade Esxi 6.7 U1 to Esxi 6.7 U2 Failed due to No space left on device

$
0
0

Update command:

# esxcli software profile update -p ESXi-6.7.0-20190402001-standard -d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml

[OSError]

[Errno 28] No space left on device

Please refer to the log file for more details.

 

Swap config:

All swap is on, datastore use datastore1 and more than 100G space.

 

 

Please see the /var/log/esxupdata.log below:

2019-04-16T00:41:48Z esxupdate: 2099451: Ramdisk: INFO: Unmounting manual tardisk /tardisks.noauto/esxupdt-2099451^@

2019-04-16T00:41:48Z esxupdate: 2099451: Ramdisk: INFO: Unmounting manual tardisk /tardisks.noauto/weaselin-2099451^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR: Traceback (most recent call last):^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:   File "/usr/lib/vmware/esxcli-software", line 470, in <module>^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:     main()^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:   File "/usr/lib/vmware/esxcli-software", line 461, in main^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:     ret = CMDTABLE[command](options)^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:   File "/usr/lib/vmware/esxcli-software", line 213, in ProfileUpdateCmd^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:     nohwwarning=opts.nohwwarning)^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:   File "/build/mts/release/bora-10764712/bora/build/esx/release/vmvisor/esxupdate/lib64/python3.5/site-packages/vmware/esx

image/Transaction.py", line 375, in UpdateProfileFromDepot^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:   File "/tmp/esx-update-2099451/usr/lib/vmware/weasel/util/upgrade_precheck.py", line 2161, in cliUpgradeAction^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:   File "/tmp/esx-update-2099451/usr/lib/vmware/weasel/util/upgrade_precheck.py", line 997, in _parseVmwareVersion^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:   File "/build/mts/release/bora-10764712/bora/build/esx/release/vmvisor/sys-boot/lib64/python3.5/subprocess.py", line 514,

in getoutput^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:   File "/build/mts/release/bora-10764712/bora/build/esx/release/vmvisor/sys-boot/lib64/python3.5/subprocess.py", line 495,

in getstatusoutput^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:   File "/build/mts/release/bora-10764712/bora/build/esx/release/vmvisor/sys-boot/lib64/python3.5/subprocess.py", line 316,

in check_output^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:   File "/build/mts/release/bora-10764712/bora/build/esx/release/vmvisor/sys-boot/lib64/python3.5/subprocess.py", line 383,

in run^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:   File "/build/mts/release/bora-10764712/bora/build/esx/release/vmvisor/sys-boot/lib64/python3.5/subprocess.py", line 676,

in __init__^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR:   File "/build/mts/release/bora-10764712/bora/build/esx/release/vmvisor/sys-boot/lib64/python3.5/subprocess.py", line 1228

, in _execute_child^@

2019-04-16T00:41:48Z esxupdate: 2099451: root: ERROR: OSError: [Errno 28] No space left on device

App Volumes Provisioning Machine

$
0
0

Author :

URL : http:////docs.vmware.com/en/VMware-App-Volumes/2.12.1/com.vmware.appvolumes.user.doc/GUID-3C9DAA91-F93C-45E5-A82F-583B54BF4C8A.html

Topic Name : Introduction to VMware App Volumes

Publication Name : VMware App Volumes User Guide

Product/Version : VMware App Volumes/2.12.1

Question :

I’m using AV 2.14. Considering the AV Provisioning Machine should closely resemble the Master Image VM and if you have apps installed on the master you should install them on the Pro Machine, can I just clone the Master VM? I would think I could use the clone as the Provisioning Machine. Would this be a good idea? I’m also following the “Creating an optimized Windows image for a VMWare Horizon Virtual Desktop”

Controller is VMware certified for ESXi release 6.7 U2 issue

$
0
0

Since updating to 6.7 U2 I'm getting warnings in VSAN health that my controller is not certified for the ESXi release.

 

intel Corporation DC P3600 AIC

Avago (LSI) PERC H730P Mini

 

The weird thing is on the certified esxi releases column it actually says "ESXi 6.7 U2 (vSAN 6.7 Update 2)"

 

Is this safe to ignore?

Nvidia M10 Blast and HTML issue (PCoIP working)

$
0
0

Deployed a new cluster with Nvidia cards in them. PcOiP sessions are using the GPU as expected, but when connecting with Blast or HTML, the Video card is not being used. Screenshots below.

 

Any help would be much appreciated.

Memory assigned issue

$
0
0

Good Morning

 

need assistance with memory assignment, we have Server 2012 R2 running on a host that had initially had 12 GB (12675072 KB) of RAM and than was extended to 32 GB (33554432 KB) even the OS shows 32 GB or RAM but the granted size still shows 12 GB as a result consumed RAM is 11 GB and the program that we using SQL cannot run more RAM. what can i do to have this host granted RAM of 32 GB.

HostRAM2.JPGHostRAM1.JPG


QueryDiskChangedAreas and QueryAllocatedBlocks fails with FileFault : ESXMapperGetPhysicalMapping: Failed to get physical mapping: 190004 Inappropriate ioctl for device

$
0
0

On a ESXi 5.5 we are trying to take snapshot and read the changes while CBT is enabled on VM. The API fails to give the information and throws a FileFault. Following are the error lines that I see in vmware log:

 

DISKLIB-CTK   : Auto blocksize for size 230686720 is 128.

DISKLIB-CTK   : Auto blocksize for size 377487360 is 256.

DISKLIB-CBT   : Initializing ESX kernel change tracking for fid 1505332471.

DISKLIB-CBT   : Successfuly created cbt node 59b98cf7-cbt.

DISKLIB-CBT   : Opening cbt node /vmfs/devices/cbt/59b98cf7-cbt

OBJLIB-FILEBE : FileBEIoctl: ioctl operation failed on '/vmfs/devices/cbt/59b98cf7-cbt' : Inappropriate ioctl for device (1638402)

ESXMapperGetPhysicalMapping: Failed to get physical mapping: 190004 Inappropriate ioctl for device

DISKLIB-CBT   : Initializing ESX kernel change tracking for fid 1406045430.

DISK: Change tracking for disk scsi0:0 is now enabled.

DISKLIB-CBT   : Successfuly created cbt node 53ce8cf6-cbt.

DISKLIB-CBT   : Opening cbt node /vmfs/devices/cbt/53ce8cf6-cbt

OBJLIB-FILEBE : FileBEIoctl: ioctl operation failed on '/vmfs/devices/cbt/53ce8cf6-cbt' : Inappropriate ioctl for device (1638402)

ESXMapperGetPhysicalMapping: Failed to get physical mapping: 190004 Inappropriate ioctl for device

VCHA Setup - vCenter HA has an invalid configuration. Remove vCenter HA to destroy the current cluster configuration and set up vCenter HA again.

$
0
0

I'm trying to setup VCHA in vCenter 6.7, after the deployment of the Passive and Witness nodes completes I get the error message "vCenter HA has an invalid configuration. Remove vCenter HA to destroy the current cluster configuration and set up vCenter HA again.

 

Is there anywhere I can find what the actual issue is and troubleshoot further?

iSCSI Datastore inactive

$
0
0

Hi all,

After updating ESX Host to VMware ESXi, 6.5.0, 13635690 my iSCSI Datastore is inactive and VM´s are inaccessable.
iSCSI Target is Synology RS812RP+

 

Any ideas?

Thanks in advance

Are this servers in an active certification process for vSphere 6.7?

$
0
0

Hi Folks,

 

I have several hundred servers. They are not very old but they are supported in the HCL only until vSphere 6.5u1 or u2. See the table down:

 

Server

CPU

Newest compatible vSphere Version

ProLiant BL460c Gen9

Intel(R) Xeon(R) CPU E5-2695 v3 @ 2.30GHz

6.5 U2

ProLiant BL460c Gen8

Intel(R) Xeon(R) CPU E5-2650 v2 @ 2.60GHz

6.5 U2

ProLiant BL460c Gen8

Intel(R) Xeon(R) CPU E5-2665 0 @ 2.40GHz

6.5 U2

PRIMERGY BX924 S4

Intel(R) Xeon(R) CPU E5-2650 v2 @ 2.60GHz

6.5 U1

ProLiant BL460c Gen9

Intel(R) Xeon(R) CPU E5-2623 v3 @ 3.00GHz

6.5 U2

 

Do know someone if some or all this server models are at the moment in an active certification process for vSphere 6.7?

 

Best Regards,

Fernando

[HELP]2(two) virtual nics with same MAC Address

$
0
0

Hello guys, i have an VMware vSphere 6 Hypervisor and i´m having a problem with my Virtual Machines where, when i add two or more virtual nics in the VM´s, when the VM come UP, simply the vSwitch configure the same MAC Address to the NICS running only one network card in my network. If i ping to the network cards, only one NIC respond the package and only when i turn off the network card that is responding, the other card starts to run and respond to pings. The NICS are automatically configurated and i´m not configure anything more. i Think this is a bug ? Or have one thing that i can do and i did not do ? Thanks for any help.

 

Pictures about what i said.

Printscreen on NIC Configured:

Image 1.jpeg

Printscreen on what vSwitch is showing:

Image 2.jpeg

Workspace ONE - AirWatch Provisioning App

$
0
0

The AirWatch Provisioning App within Workspace ONE is still relatively new and although it has it quirks, it can still be useful in certain use cases.

 

So what is the AirWatch Provisioning App used for?

 

The app is designed for the use cases where there is no on premise ldap server that can be used with the Workspace ONE UEM Cloud Connector to synchronize users.  This app can be used when users are created in Workspace ONE Identity via SCIM or JIT. Workspace ONE Identity will then create the users in Workspace ONE UEM.

 

Lets first discuss some important information about using the AirWatch Provisioning App in Workspace ONE:

 

  • Currently, Workspace ONE will only provision at the top level (Customer) Organization Group (OG) in Workspace UEM.
  • An LDAP Server can NOT be configured at the top level OG in Workspace ONE UEM (unless the users exist in the directory that will be created - but if this is the case, you shouldn't be using the provisioning adapter)
  • Workspace ONE Identity needs to be configured as a SAML Provider at the top level OG.
  • If you are using JIT to create users in Workspace ONE Identity, you MUST send a valid GUID to Workspace ONE has part of the SAML attributes. This is required if you plan on using the Workspace ONE Hub native application to enroll your device. This GUID will be mapped to the External ID and provisioned to Workspace ONE UEM. See  https://www.uuidgenerator.net/ as an example.
  • If you are using JIT to create users in Workspace ONE Identity, you need to use a web browser to log into Workspace ONE initially before using the Workspace ONE Hub native app. This limitation is because the user needs to exist in UEM at the time of enrollment.

 

Step 1: Export your Workspace ONE IDP Metadata

  1. Log into Workspace ONE Identity and go to Catalog -> Settings
  2. Click on SAML Metadata
  3. Download your "Identity Provider (IdP) metadata"
    Screen Shot 04-25-19 at 01.13 PM.PNG

 

Step 2: Configure UEM to use SAML Authentication

  1. Log into Workspace ONE UEM
  2. Go to Group & Settings -> All Settings -> System -> Enterprise Integration -> Directory Services
  3. Ensure Directory Type is set to "None"
  4. Enable "Use SAML for Authentication"
  5. Under Enable SAML Authentication for*, check Self-Service Portal and Enrollment.
  6. Enable "Use New SAML Authentication Endpoint"
    Screen Shot 04-25-19 at 01.19 PM.PNG
    Note: This step might be a bit confusing as to why we have to configure UEM in this manner. It was confusing to me at first.  The provisioning adapter in Workspace ONE Identity will leverage the REST API to create accounts in UEM. To create user accounts in UEM (of Directory Type), it requires that either a Directory is configured or SAML is enabled. As mentioned earlier, we can not enable a directory so we essentially have to configure SAML. 


  7. In the SAML 2.0 section, click upload to Import Identity Provider Settings
  8. Select the metadata you downloaded in Step 1.
  9. Scroll down and click save.

 

Step 3: Add AirWatch Provision App in Workspace ONE Identity

  1. In Workspace ONE Identity, go to Catalog-> New
  2. Browse from the Catalog and select "AirWatch Provisioning"
    Screen Shot 04-23-19 at 02.47 PM 002.PNG
  3. Click Next
  4. Edit the Single Sign-On URL and Recipient URL with your UEM server
    Screen Shot 04-25-19 at 02.13 PM.PNG
  5. Keep the "default_access_policy_set" and Click Next
  6. Click Save
    Screen Shot 04-23-19 at 02.49 PM 001.PNG
  7. Select the AirWatch Provisioning App and Click Edit
  8. Click Next
  9. On the Configuration Tab, enable "Setup Provisioning"
    Screen Shot 04-25-19 at 02.13 PM 001.PNG
  10. Click Next
  11. Enter your AirWatch Device Services URL
  12. Enter your Admin Username
  13. Enter your Admin Password
    Note: Whenever you edit this application be very careful of Chrome's password auto-fill. It will update the password if you have one saved in chrome. After you hit test connection it will revert back to your saved password in Chrome.
  14. Enter your AirWatch API Key
    Note: If you don't have an API Key, in UEM, go to Groups & Settings -> All Settings -> System -> Advanced -> API -> REST API
    Click Override -> Add
    Provide a Service Name with the account type of Admin.  Copy the API Key.
  15. Enter your top level OG Group ID
  16. Click Test Connection and validate connectivity.
  17. Click Enable Provisioning
    Screen Shot 04-25-19 at 01.39 PM.PNG
  18. Verify the mapping are correct. If you are using JIT, make sure all these attributes have come over in the SAML assertion.
    Screen Shot 04-23-19 at 02.53 PM 001.PNG
  19. Under Group Provisioning, add any groups you want to provision to UEM.
    Screen Shot 04-23-19 at 02.53 PM 004.PNG
  20. Click Next
  21. Click Save

 

Note: If you get an error when saving, please see the note earlier about chrome's auto password fill.

 

Step 4: Entitle Users to the AirWatch Provisioning App

You have the option of entitling users individually or using a group. If you are using JIT you might want to consider using a dynamic group.

 

  1. Click the Assign button on the AirWatch Provisioning App
  2. Search for the user and/or group
  3. Under "Deployment Type" you MUST Select Automatic. If you leave the default "User Activated" it will never get provisioned to the user.

Screen Shot 04-23-19 at 02.55 PM 001.PNG

 

Step 5: Create a Dynamic Group (Optional)

If you are using JIT to create users into Workspace ONE, it easier to create a dynamic group and assign that group to the provisioning adapter.

  1. Click on "Users & Groups"
  2. Click on Groups
  3. Click Add Group
  4. Provide a group name and Click Next
  5. Do not select any users and Click Next
  6. Under Group Rules, you can either choose based on the JIT Directory that was created or the domain you chose for the JIT Users
  7. Click Next
  8. Click Next to exclude users
  9. Click Create Group

 

Troubleshooting

  1. If you receive the error "Error not provisioned" in the assignment screen and you hover over the error message and see "Failed to validate attributes while trying to provision user" this means that the values for the attributes you used in Attribute Mappings of the provisioning adapter configuration are either null or missing. Please make sure you create the user in Workspace ONE Identity with all the necessary attributes to create the account in Workspace ONE UEM. This includes the External ID. Please see the note at the beginning of the blog regarding the External ID
    Screen Shot 05-01-19 at 09.16 AM.PNG
  2. While trying to enroll your device with the HUB application application you receive a generic error like "An Error has occurred". See the note about External ID.
  3. When trying to provision the Mobile SSO profile you receive an error that the PrincipalName contains an invalid value.
    Screen Shot 05-01-19 at 09.04 AM.PNG
    This means that you have probably created the Workspace ONE UEM account with an email as the Username. When the Mobile SSO certificate payload was created, it uses the username as the principal name on the certificate. Unfortunately you can not have the "@" character in the principle name. You have two choices to resolve this issue:
    a) In the AIrWatch Provisioning Adapter mappings, use another attribute to represent the username that does not contain the @ sign. You might need to adjust the values being imported into Workspace ONE identity (whether by JIT or via the connector). Please make sure the username and the prefix of the UPN remain the same.
    b) Use a lookup in Workspace ONE UEM to parse the prefix of the email address and use that in the certificate payload:
    Group & Settings -> All Settings -> Devices & Users -> General -> Lookup Fields
    Add Custom Field
    Create a Name such as EmailNickName and use a regex such as ".+?(?=@)"
    Screen Shot 05-01-19 at 09.14 AM.PNG
    You can then use "EmailNickName" in your Certificate Payload
    Screen Shot 05-01-19 at 09.12 AM.PNG









Workspace ONE - How to Configure IOS Mobile SSO

$
0
0

In this blog post, we will walk through the steps to configure IOS Mobile SSO.

 

I will be assuming that your Workspace ONE UEM and Workspace ONE Identity Manager environments have not been previously integrated.

 

This blog will assume that you already have an Enterprise Cloud Connector installed and syncing with Workspace ONE UEM.

 

In this blog, we'll cover:

  1. Configure Workspace ONE Identity in the UEM Console
  2. Enable Active Directory Basic
  3. Enable Mobile SSO
  4. Basic Troubleshooting

 

Validation of Pre-requisites

 

  1. Log into Workspace ONE UEM -> Global Settings -> All Settings -> System -> Enterprise Integration -> Cloud Connector
  2. Ensure AirWatch Cloud Connector is enabled
  3. Perform a Test Connection. Make sure the connection is active
    Screen Shot 04-22-19 at 01.33 PM.PNG
  4. Click on Directory Services from the left menu
  5. Ensure your directory has been configured and you can perform a successful test connection
    Screen Shot 04-22-19 at 01.39 PM.PNG
  6. Close from Settings and go to accounts on the main left in Workspace ONE UEM.
  7. Make sure you have users being synchronized into Workspace ONE UEM
    Screen Shot 04-22-19 at 01.42 PM.PNG

 

Step 1: Configure Workspace ONE Identity in the UEM Console

Although this step is not absolutely required to get Mobile SSO working, I highly recommend you configure this as its required for Device Compliance, Unified Catalog and UEM Password Authentication.

In previous versions of Workspace ONE UEM, there was a lot of manual configuration required to enable Workspace ONE Identity.  Using the wizard in Workspace ONE UEM we can automate a lot of these tasks.

 

Click on Getting Started

  1. Under Workspace ONE -> Begin Setup
    Screen Shot 04-22-19 at 01.56 PM.PNG
  2. Under Identity and Access Management -> Click Configure for "Connect to VMware Identity Manager"
    Screen Shot 04-22-19 at 01.58 PM.PNG
  3. Click Continue
    Screen Shot 04-22-19 at 02.01 PM.PNG
  4. Enter your Tenant URL, User name, and Password
    Screen Shot 04-22-19 at 02.03 PM 001.PNG
  5. Click Save
  6. If you check your Workspace ONE Identity tenant, you will see that AirWatch configuration as been completed: Identity & Access Management -> Setup -> AirWatch

 

Step 2: Enable Active Directory Basic

VMware recommends you download and install the VMware Identity Manager connector to synchronize users from your Active Directory to Workspace ONE Identity. However, for the purpose of this blog we are going to leverage to built-in capabilities of Workspace UEM to provision users directly into Workspace ONE Identity.

 

  1. In Workspace ONE UEM, Groups & Settings -> All Settings -> System -> Enterprise Integration -> VMware Identity Manager -> Configuration
  2. You will see under the server settings that "Active Directory Basic" is disabled
    Screen Shot 04-22-19 at 02.18 PM.PNG
  3. Click "Enabled" beside Active Directory Basic
  4. You will be prompted to enter your password
    Screen Shot 04-22-19 at 02.19 PM.PNG
  5. Click Next
  6. Enter a name for your directory (This will be name of the directory in Workspace ONE Identity). You can leave Enable Custom Mapping to standard
    Screen Shot 04-22-19 at 02.21 PM.PNG
  7. Click Save
  8. If everything worked successfully, you should see your a new directory appear in Workspace ONE Identity with your synchronized users:
    Screen Shot 04-22-19 at 02.22 PM.PNG

 

Step 3: Enable Mobile SSO

  1. Lets go back to the "Getting Started Section" of Workspace ONE UEM
  2. Under Workspace ONE -> Continue
  3. Under Identity & Access Management -> Mobile Single-Sign-On, click Configure
    Screen Shot 04-22-19 at 02.33 PM.PNG
  4. Click "Get Started"
    Screen Shot 04-22-19 at 02.35 PM.PNG
  5. Click Configure to use the AirWatch Certificate Authority
    Screen Shot 04-22-19 at 02.38 PM.PNG
  6. Click Start Configuration
    Screen Shot 04-22-19 at 02.40 PM.PNG
  7. Click Finish when complete
    Screen Shot 04-22-19 at 02.41 PM.PNG
  8. Click Close

Basic Troubleshooting

There are a variety of reasons that Mobile SSO can fail. Lets go over a few of the common reasons.

 

  1. You are prompted for a username/password or the Workspace ONE Domain chooser when doing Mobile SSO
    The problem here is that Mobile SSO has failed and Workspace ONE Identity is triggering the fallback authentication mechanism. For the purpose of troubleshooting, I recommend removing the fallback mechanism. In the IOS  Policy, remove Certificate Authentication and Password (Local Directory). When you test again you will be prompted with an error message instead.
    Screen Shot 04-22-19 at 03.22 PM.PNG
  2. You are prompted with an error  message "Access denied as no valid authentication methods were found"
    a) Check to make sure the "Ios_Sso" profile was pushed to the device. By default, when the profile is created it does not have an assignment group. If not, create an smart group and assign the profile and publish.
  3. You received the error "The required field “Keysize” is missing" when deploying the IOS Mobile SSO Profiless
    Something went wrong with the import of the KDC Certificate from Workspace ONE Identity to UEM.
    a)Log into Workspace ONE Identity -> Identity & Access Management -> Identity Providers -> Built-In and download the KDC Certificate:
    Screen Shot 04-22-19 at 04.20 PM.PNG
    b) Now switch back to UEM, Devices -> Profiles & Resources -> Profiles
    c) Edit the IOS Profile
    d) Click Credentials and re-upload the KDC Certificate.

  4. You received the message "Kerberos NEGOTIATE failed or was cancelled by the user"

    Unfortunately this is a catch all error message for mobile sso failures can could be many things. I'll try to cover some of the common reason here:

    a) In Workspace ONE UEM, check your IOS Mobile SSO profile -> Single Sign-on. Verify the Realm is correct. For production it should be "VMWAREIDENTITY.COM". However if you have localized cloud tenant this can be different (VMWAREIDENTITY.EU, VMWAREIDENTITY.ASIA,  VMWAREIDENTITY.CO.UK, VMWAREIDENTITY,COM.AU, VMWAREIDENTITY.CA, VMWAREIDENITY.DE).  For non-production, you might be on the vidmpreview.com domain. If this is the case, it should be "VIDMPREVIEW.COM"

    b) When you use the wizard to create the Mobile SSO configuration, it will automatically add the application bundle id's where Mobile SSO is allowed. You will need to either enter all your application bundle id's into the profile or optionally delete them all. If you don't specify the bundle id's, it will allow them all.  I recommend for a POC, you leave this blank.

    c) Mobile SSO on IOS is based on Kerberos. The kerberos negotiation works of Port 88 on UDP. Ensure that your firewall is not blocking this port.

    d)The built-in AirWatch Certificate Authority uses the username (usually sAMAccountName) as the principal name on the certificate provisioned to the device. The kerberos negotiation will use the username to formulate a user principle name which needs to match in Workspace ONE Identity. A problem can occur when organizations define their UPN with a different prefix than the sAMAcountName. So if my my username is "jdoe" but my UPN is "john.doe@domain.com". In this scenario, Mobile SSO will fail. In this scenario, we can:


    i) Sync sAMAccountName as the UPN in Workspace ONE Identity (Note: This can have potential issues with downstream applications but you can always pull the UPN as a custom attribute as well)
    ii) Use a custom certificate authority in Workspace ONE UEM and configure a kerberos template with the correct values.

Vsphere WebClient SDK V6.7U2 - problems to setup tomcat server in eclipse

$
0
0

Hi,

 

I saw that the new sdk is available, so I downloaded it.  After realizing that the   "Eclipse-Setup.html" which is found in the "docs" subdirectory is out of date (still refers to the virgo server instead of tomcat)

I also downloaded the "Developing Local Plug-ins with vSphere Client SDK - VMWare vSphere 6.7".

I  followed the directions in this file, and even got rid of my old sts - and replaced it with the newest Eclipse - so I could match the directions completely.

 

Starting the tomcat directly using the "startup.bat" script worked as expected, I could login to the remote vCenter and see the inventory.

Then I stopped it and tried to start it within the eclipse - after trying and retrying for a complete day, I have given up.

I got to the Chapter "Configure the Tomcat Server in Your Eclipse IDE" - here you are instructed to add a new server "Apache->Tomcat v8.5" - ok

Then you should set the VMWARE_CFG_DIR to the correct directory - also ok

Then it says "From the Overview Page" you should set values in the "Server Startup Configuration" and "Redeploy Behavior" Panes - these are not available for me in the Server Configuration ...

Instead, you are expected to configure ports 2 for http, and one for SSL - so I set them to 9090 and 9443 respectively.

 

I then started the tomcat - and it started successfully.  But none of the Html Client packages were deployed.  I checked out the catalina.bat and saw values for things like ports (http.port, https.port, shutdown.port) etc. are configured here - but do not seem to be confiured when the tomcat is started from eclipse.  I added the defines in the runtime environment, but this did not help either.

 

So it seems to me that this Chapter is not complete - or does not match together with the newest version of eclipse.   Could you please tell me how to get the tomcat server to pickup the vpshere packages?

I checked the logs - in "access"-> localhost_acess_log.xxx.txt I see:

120.0.0.1 ... "GET / HTTP1.1" 404 -- http-nio-127.0.0.1-9090-exec 1 0

The catalina.log looks very much like the one written when the startup.bat is called. I could find no error.

They other logs (also the virgo log) are missing or have no content.

 

thanks for the help

Cathy

Cannot connect to vCenter server

$
0
0

Hi!

I'm trying to connec to to a vCenter server from powershell session with PowerCLI module loaded but receive the following error:

Connect-VIServer : Could not load file or assembly 'VMware.Vim, Version=6.7.0.185, Culture=neutral,PublicKeyToken=null' or one of its dependencies. The system cannot find the file specified.At line:1 char:1

Here is the script code:

 

#Unload existing PowerCLI

If (Get-PSSnapin | ? {$_.Name -like "VMware*"}) { Get-PSSnapin VMware* | Remove-PSSnapin }

If (Get-Module | ? {$_.Name -like "VMware*"}) { Get-Module VMware* | Remove-Module -Force }

 

#Import PowerCLI v11

$ModulePath = $PSScriptRoot +"\Modules\VMware-PowerCLI-11.2.0.12780525"

$env:PSModulePath = $ModulePath

Import-Module VMware.VimAutomation.Core

 

#Set PowerCLI configuration

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Scope Session -DisplayDeprecationWarnings:$false -Confirm:$false | out-null

Connect-VIServer ********

....

....

 

$env:PSModulePath variable does not contain old PowerCLI paths and after loading new path to $env:PSModulePath shows :

PS C:\Users\a> get-module -listavailable

 

    Directory: D:\*******\Modules\VMware-PowerCLI-11.2.0.12780525

 

ModuleType Name                                ExportedCommands

---------- ----                                ----------------

Script     VMware.DeployAutomation             {Add-DeployRule, Add-ProxyServer, Add-ScriptBundle, Copy-DeployRule...}

Script     VMware.ImageBuilder                 {Add-EsxSoftwareDepot, Add-EsxSoftwarePackage, Compare-EsxImageProfil...

Manifest   VMware.PowerCLI

Script     VMware.Vim

Script     VMware.VimAutomation.Cis.Core       {Connect-CisServer, Disconnect-CisServer, Get-CisService}

Script     VMware.VimAutomation.Cloud          {Add-CIDatastore, Connect-CIServer, Disconnect-CIServer, Get-Catalog...}

Script     VMware.VimAutomation.Common

Script     VMware.VimAutomation.Core           {Add-PassthroughDevice, Add-VirtualSwitchPhysicalNetworkAdapter, Add-...

Script     VMware.VimAutomation.Hcx            {Connect-HCXServer, Disconnect-HCXServer, Get-HCXAppliance, Get-HCXAp...

Script     VMware.VimAutomation.HorizonView    {Connect-HVServer, Disconnect-HVServer}

Script     VMware.VimAutomation.License        Get-LicenseDataManager

Script     VMware.VimAutomation.Nsxt           {Connect-NsxtServer, Disconnect-NsxtServer, Get-NsxtPolicyService, Ge...

Script     VMware.VimAutomation.Sdk            {Get-ErrorReport, Get-InstallPath, Get-PSVersion}

Script     VMware.VimAutomation.Security       {Get-SecurityInfo, Get-VTpm, Get-VTpmCertificate, Get-VTpmCSR...}

Script     VMware.VimAutomation.Srm            {Connect-SrmServer, Disconnect-SrmServer}

Script     VMware.VimAutomation.Storage        {Add-KeyManagementServer, Copy-VDisk, Export-SpbmStoragePolicy, Get-K...

Script     VMware.VimAutomation.StorageUtility Update-VmfsDatastore

Script     VMware.VimAutomation.Vds            {Add-VDSwitchPhysicalNetworkAdapter, Add-VDSwitchVMHost, Export-VDPor...

Script     VMware.VimAutomation.Vmc            {Connect-Vmc, Disconnect-Vmc, Get-VmcSddcNetworkService, Get-VmcServi...

Script     VMware.VimAutomation.vROps          {Connect-OMServer, Disconnect-OMServer, Get-OMAlert, Get-OMAlertDefin...

Script     VMware.VumAutomation                {Add-EntityBaseline, Copy-Patch, Get-Baseline, Get-Compliance...}

 

Get-Module also shows different VMware.Vim that in the error:

PS C:\Users\a> Get-Module | select  ModuleType,name,version

                             ModuleType Name                                    Version

                             ---------- ----                                    -------

                               Manifest Microsoft.PowerShell.Management         3.0.0.0

                               Manifest Microsoft.PowerShell.Utility                      3.0.0.0

                                 Script VMware.Vim                                            6.7.0.12483609

                                 Script VMware.VimAutomation.Cis.Core           11.2.0.12483642

                                 Script VMware.VimAutomation.Common             11.2.0.12483627

                                 Script VMware.VimAutomation.Core               11.2.0.12483638

                                 Script VMware.VimAutomation.Sdk                11.2.0.12483635

 

Which is quite weird imho...

 

PowerCLI 5.5 is installed on the following machine (do not ask me to remove or update it, I cannot modify it). If i remove PowerCLI 5.5 from the system- everything works fine. But i cannot remove it.

Any ideas how can I resolve it and import PowerCLI 11 without removing 5.5 into a powershell session?

P.S. OS is w2012 (not R2), and it is isolated from the Internet.

Getting "Connection refused" error in eclipse/IntelliJ while connecting it to vRO 7.5 which is in debug mode

$
0
0

I am getting "Connection refused" error in eclipse/IntelliJ while connecting it to vRO 7.5 which is in debug mode.

I have tried connecting to 4-5 vRO's(version 7.5) from my eclipse but getting same error.

 

Maximum host uptime

$
0
0

OK people, what's the maximum uninterrupted uptime you've had for a host?

 

From my side, we have an ESX v2.5.2 host in our test lab which is currently showing 338 days (and yes, it does have some VMs running on it!)

 

Anyone better that?

 

Chris

How do you troubleshoot ESXi host PSOD problems?

$
0
0

Can some one tell me How do you troubleshoot ESXi host PSOD problems?

Viewing all 180923 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>